Analysis Overview
SHA256
5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a
Threat Level: Known bad
The file 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a was found to be: Known bad.
Malicious Activity Summary
Modifies visibility of file extensions in Explorer
Modifies WinLogon for persistence
Modifies visiblity of hidden/system files in Explorer
Disables RegEdit via registry modification
Event Triggered Execution: Image File Execution Options Injection
Drops startup file
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Reads user/profile data of web browsers
Enumerates connected drives
Adds Run key to start application
Drops file in System32 directory
Drops file in Windows directory
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Unsigned PE
Suspicious use of SetWindowsHookEx
Modifies registry class
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-11-08 22:55
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-08 22:55
Reported
2024-11-08 22:58
Platform
win7-20241010-en
Max time kernel
150s
Max time network
19s
Command Line
Signatures
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O52525Z\\TuxO52525Z.exe\"" | C:\Windows\M24627\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M24627\\Ja280254bLay.com\"" | C:\Windows\M24627\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O52525Z\\TuxO52525Z.exe\"" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M24627\\Ja280254bLay.com\"" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O52525Z\\TuxO52525Z.exe\"" | C:\Windows\M24627\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M24627\\Ja280254bLay.com\"" | C:\Windows\M24627\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O52525Z\\TuxO52525Z.exe\"" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M24627\\Ja280254bLay.com\"" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
Modifies visibility of file extensions in Explorer
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" | C:\Windows\M24627\smss.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" | C:\Windows\M24627\EmangEloh.exe | N/A |
Modifies visiblity of hidden/system files in Explorer
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | C:\Windows\M24627\smss.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | C:\Windows\M24627\EmangEloh.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Windows\M24627\smss.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Windows\M24627\EmangEloh.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
Event Triggered Execution: Image File Execution Options Injection
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe | C:\Windows\M24627\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Windows\M24627\smss.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe | C:\Windows\M24627\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Windows\M24627\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Windows\M24627\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe | C:\Windows\M24627\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Windows\M24627\EmangEloh.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe | C:\Windows\M24627\smss.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd | C:\Windows\M24627\EmangEloh.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd | C:\Windows\M24627\smss.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| N/A | N/A | C:\Windows\M24627\smss.exe | N/A |
| N/A | N/A | C:\Windows\M24627\EmangEloh.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T25Z627 = "C:\\Windows\\sa-644166.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\T1246166TT4 = "C:\\Windows\\system32\\1627678306l.exe" | C:\Windows\M24627\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T25Z627 = "C:\\Windows\\sa-644166.exe" | C:\Windows\M24627\smss.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\T1246166TT4 = "C:\\Windows\\system32\\1627678306l.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T25Z627 = "C:\\Windows\\sa-644166.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\T1246166TT4 = "C:\\Windows\\system32\\1627678306l.exe" | C:\Windows\M24627\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T25Z627 = "C:\\Windows\\sa-644166.exe" | C:\Windows\M24627\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\T1246166TT4 = "C:\\Windows\\system32\\1627678306l.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
Enumerates connected drives
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\1627678306l.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\msvbvm60.dll | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\1627678306l.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| File opened for modification | \??\c:\Windows\SysWOW64\IME\shared\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | C:\Windows\SysWOW64\016276078306l.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\016276078306l.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | C:\Windows\SysWOW64\X40223go\Z16276cie.cmd | C:\Windows\M24627\smss.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\X40223go\Z16276cie.cmd | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\SysWOW64\IME\shared\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\msvbvm60.dll | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | C:\Windows\SysWOW64\1627678306l.exe | C:\Windows\M24627\smss.exe | N/A |
| File created | C:\Windows\SysWOW64\1627678306l.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\1627678306l.exe | C:\Windows\M24627\EmangEloh.exe | N/A |
| File created | \??\c:\Windows\SysWOW64\IME\shared\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\msvbvm60.dll | C:\Windows\M24627\EmangEloh.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\X40223go\Z16276cie.cmd | C:\Windows\M24627\EmangEloh.exe | N/A |
| File created | C:\Windows\SysWOW64\1627678306l.exe | C:\Windows\M24627\EmangEloh.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\X40223go\Z16276cie.cmd | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| File created | C:\Windows\SysWOW64\X40223go\Z016276cie.cmd | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\msvbvm60.dll | C:\Windows\M24627\smss.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\msvbvm60.dll | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\1627678306l.exe | C:\Windows\M24627\smss.exe | N/A |
| File opened for modification | \??\c:\Windows\SysWOW64\IME\shared\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | \??\c:\Program Files\Common Files\Microsoft Shared\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\Common Files\Microsoft Shared\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Program Files\Windows Sidebar\Shared Gadgets\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Program Files (x86)\Common Files\microsoft shared\Titip Folder Jangan DiHapus .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Program Files (x86)\Google\Update\Download\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Google\Update\Download\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Program Files\DVD Maker\Shared\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\DVD Maker\Shared\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\Windows Sidebar\Shared Gadgets\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Common Files\microsoft shared\Titip Folder Jangan DiHapus .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | \??\c:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | C:\Windows\M24627\smss.exe | C:\Windows\M24627\smss.exe | N/A |
| File created | C:\Windows\M24627\Ja280254bLay.com | C:\Windows\M24627\smss.exe | N/A |
| File created | C:\Windows\M24627\EmangEloh.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| File created | \??\c:\Windows\Downloaded Program Files\Lagu - Server .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\system\msvbvm60.dll | C:\Windows\M24627\smss.exe | N/A |
| File opened for modification | C:\Windows\M24627\Ja280254bLay.com | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\M24627\Ja280254bLay.com | C:\Windows\M24627\smss.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\M24627\Ja280254bLay.com | C:\Windows\M24627\EmangEloh.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | C:\Windows\Ti78306ta.exe | C:\Windows\M24627\EmangEloh.exe | N/A |
| File opened for modification | C:\Windows\M24627 | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| File opened for modification | \??\c:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\New mp3 BaraT !! .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\Lagu - Server .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\SoftwareDistribution\Download\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\Ti78306ta.exe | C:\Windows\M24627\EmangEloh.exe | N/A |
| File opened for modification | C:\Windows\system\msvbvm60.dll | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\sa-644166.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | \??\c:\Windows\Downloaded Program Files\Lagu - Server .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\system\msvbvm60.dll | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\New mp3 BaraT !! .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\TutoriaL HAcking .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File opened for modification | C:\Windows\M24627\EmangEloh.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File opened for modification | C:\Windows\Ti078306ta.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | C:\Windows\M24627\Ja280254bLay.com | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\Titip Folder Jangan DiHapus .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | C:\Windows\Ti078306ta.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File opened for modification | \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\Lagu - Server .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | C:\Windows\M24627\EmangEloh.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | C:\Windows\M24627\EmangEloh.exe | C:\Windows\M24627\smss.exe | N/A |
| File opened for modification | C:\Windows\system\msvbvm60.dll | C:\Windows\M24627\EmangEloh.exe | N/A |
| File created | C:\Windows\M24627\EmangEloh.exe | C:\Windows\M24627\EmangEloh.exe | N/A |
| File created | C:\Windows\sa-644166.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\TutoriaL HAcking .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\TutoriaL HAcking .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | C:\Windows\M24627\EmangEloh.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | C:\Windows\M24627\Ja280254bLay.com | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\Lagu - Server .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\New mp3 BaraT !! .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | C:\Windows\M24627\smss.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | C:\Windows\M24627\smss.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | C:\Windows\M24627\smss.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| File opened for modification | C:\Windows\[TheMoonlight].txt | C:\Windows\M24627\EmangEloh.exe | N/A |
| File created | \??\c:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| File created | \??\c:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\M24627\smss.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\M24627\EmangEloh.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile | C:\Windows\M24627\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" | C:\Windows\M24627\smss.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile | C:\Windows\M24627\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" | C:\Windows\M24627\EmangEloh.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe | N/A |
| N/A | N/A | C:\Windows\M24627\smss.exe | N/A |
| N/A | N/A | C:\Windows\M24627\EmangEloh.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe
"C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe"
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\service.exe"
C:\Windows\M24627\smss.exe
"C:\Windows\M24627\smss.exe"
C:\Windows\M24627\EmangEloh.exe
"C:\Windows\M24627\EmangEloh.exe"
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O52525Z\winlogon.exe"
Network
Files
memory/2772-1-0x0000000000020000-0x0000000000022000-memory.dmp
memory/2772-0-0x0000000000400000-0x0000000000435000-memory.dmp
C:\Windows\M24627\EmangEloh.exe
| MD5 | 0356b7bb07355265f73cbb010ae45041 |
| SHA1 | 9223d100e366a21ae395c9a7b64b13ddb236c389 |
| SHA256 | 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a |
| SHA512 | 9d5b7177b162135338946ba1bb90d264c646e799c7980f9355973585a73d94010a95b2f8704293d60919639bb142ae7a66205bb1c2927b88b52ff1b4c9a1ea43 |
memory/2772-33-0x0000000002950000-0x0000000002960000-memory.dmp
memory/2772-40-0x00000000034B0000-0x00000000034E5000-memory.dmp
memory/2772-41-0x00000000034B0000-0x00000000034E5000-memory.dmp
memory/2688-44-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2688-55-0x0000000000020000-0x0000000000022000-memory.dmp
memory/2660-54-0x0000000000020000-0x0000000000022000-memory.dmp
memory/2660-53-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2772-52-0x00000000034B0000-0x00000000034E5000-memory.dmp
C:\Windows\system\msvbvm60.dll
| MD5 | 5343a19c618bc515ceb1695586c6c137 |
| SHA1 | 4dedae8cbde066f31c8e6b52c0baa3f8b1117742 |
| SHA256 | 2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce |
| SHA512 | 708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606 |
memory/1844-101-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2772-100-0x0000000003CB0000-0x0000000003CE5000-memory.dmp
memory/2772-99-0x0000000003CB0000-0x0000000003CE5000-memory.dmp
C:\Windows\[TheMoonlight].txt
| MD5 | 68c7836c8ff19e87ca33a7959a2bdff5 |
| SHA1 | cc5d0205bb71c10bbed22fe47e59b1f6817daab7 |
| SHA256 | 883b19ec550f7ddb1e274a83d58d66c771ab10fefd136bab79483f2eb84e7fec |
| SHA512 | 3656005148788ed7ac8f5b5f8f6f4736c2dc4a94771291170e61666beb81e63be2a1a0f2913233b0e3f12ddfa7f1e89da9cd8323306413395ee78b2ece7fbfe8 |
memory/2372-125-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2772-129-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2688-174-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2660-175-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-177-0x0000000000400000-0x0000000000435000-memory.dmp
memory/1844-176-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2660-185-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2688-184-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-187-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2688-192-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-195-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2660-197-0x0000000000400000-0x0000000000435000-memory.dmp
memory/1844-198-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-199-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-203-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-207-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2688-208-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-211-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2688-212-0x0000000000400000-0x0000000000435000-memory.dmp
C:\Windows\[TheMoonlight].txt
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/2688-215-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-218-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-219-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-223-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-227-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2688-228-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-231-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2688-232-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-235-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-239-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2688-240-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2372-243-0x0000000000400000-0x0000000000435000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-08 22:55
Reported
2024-11-08 22:58
Platform
win10v2004-20241007-en
Max time kernel
150s
Max time network
138s
Command Line
Signatures
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M13516\\Ja634608bLay.com\"" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O41414Z\\TuxO41414Z.exe\"" | C:\Windows\M13516\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M13516\\Ja634608bLay.com\"" | C:\Windows\M13516\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O41414Z\\TuxO41414Z.exe\"" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M13516\\Ja634608bLay.com\"" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O41414Z\\TuxO41414Z.exe\"" | C:\Windows\M13516\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M13516\\Ja634608bLay.com\"" | C:\Windows\M13516\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O41414Z\\TuxO41414Z.exe\"" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
Modifies visibility of file extensions in Explorer
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" | C:\Windows\M13516\smss.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" | C:\Windows\M13516\EmangEloh.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
Modifies visiblity of hidden/system files in Explorer
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | C:\Windows\M13516\smss.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | C:\Windows\M13516\EmangEloh.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Windows\M13516\smss.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Windows\M13516\EmangEloh.exe | N/A |
Event Triggered Execution: Image File Execution Options Injection
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Windows\M13516\EmangEloh.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe | C:\Windows\M13516\EmangEloh.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe | C:\Windows\M13516\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe | C:\Windows\M13516\EmangEloh.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Windows\M13516\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Windows\M13516\smss.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe | C:\Windows\M13516\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" | C:\Windows\M13516\EmangEloh.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd | C:\Windows\M13516\EmangEloh.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd | C:\Windows\M13516\smss.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| N/A | N/A | C:\Windows\M13516\smss.exe | N/A |
| N/A | N/A | C:\Windows\M13516\EmangEloh.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T14Z051 = "C:\\Windows\\sa-533055.exe" | C:\Windows\M13516\smss.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1135055TT4 = "C:\\Windows\\system32\\805165323741l.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T14Z051 = "C:\\Windows\\sa-533055.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1135055TT4 = "C:\\Windows\\system32\\805165323741l.exe" | C:\Windows\M13516\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T14Z051 = "C:\\Windows\\sa-533055.exe" | C:\Windows\M13516\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1135055TT4 = "C:\\Windows\\system32\\805165323741l.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T14Z051 = "C:\\Windows\\sa-533055.exe" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1135055TT4 = "C:\\Windows\\system32\\805165323741l.exe" | C:\Windows\M13516\smss.exe | N/A |
Enumerates connected drives
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\805165323741l.exe | C:\Windows\M13516\smss.exe | N/A |
| File created | C:\Windows\SysWOW64\805165323741l.exe | C:\Windows\M13516\EmangEloh.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\msvbvm60.dll | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File opened for modification | \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Titip Folder Jangan DiHapus .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Titip Folder Jangan DiHapus .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\msvbvm60.dll | C:\Windows\M13516\EmangEloh.exe | N/A |
| File opened for modification | \??\c:\Windows\SysWOW64\IME\SHARED\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\805165323741l.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\805165323741l.exe | C:\Windows\M13516\smss.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\msvbvm60.dll | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\X38112go\Z805165cie.cmd | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| File created | \??\c:\Windows\SysWOW64\IME\SHARED\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | C:\Windows\SysWOW64\805165323741l.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\X38112go\Z805165cie.cmd | C:\Windows\M13516\EmangEloh.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\805165323741l.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\805165323741l.exe | C:\Windows\M13516\EmangEloh.exe | N/A |
| File opened for modification | \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Windows\SysWOW64\IME\SHARED\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\805165323741l.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\msvbvm60.dll | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\msvbvm60.dll | C:\Windows\M13516\smss.exe | N/A |
| File created | \??\c:\Windows\SysWOW64\IME\SHARED\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | C:\Windows\SysWOW64\X38112go\Z805165cie.cmd | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\X38112go\Z805165cie.cmd | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | C:\Windows\SysWOW64\805165323741l.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\X38112go\Z805165cie.cmd | C:\Windows\M13516\smss.exe | N/A |
| File created | C:\Windows\SysWOW64\805165323741l.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| File opened for modification | \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files (x86)\Common Files\Microsoft Shared\Titip Folder Jangan DiHapus .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\Windows Sidebar\Shared Gadgets\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Google\Update\Download\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files\dotnet\shared\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files\Microsoft Office\Updates\Download\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\Microsoft Office\Updates\Download\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files\Windows Sidebar\Shared Gadgets\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Common Files\Microsoft Shared\Titip Folder Jangan DiHapus .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\Common Files\microsoft shared\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files (x86)\Google\Update\Download\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\dotnet\shared\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Program Files\Common Files\microsoft shared\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\M13516\smss.exe | C:\Windows\M13516\smss.exe | N/A |
| File created | C:\Windows\M13516\smss.exe | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | \??\c:\Windows\InputMethod\SHARED\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | \??\c:\Windows\SoftwareDistribution\Download\SharedFileCache\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | C:\Windows\M13516\Ja634608bLay.com | C:\Windows\M13516\smss.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\M13516\EmangEloh.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | C:\Windows\Ti323741ta.exe | C:\Windows\M13516\smss.exe | N/A |
| File opened for modification | \??\c:\Windows\Downloaded Program Files\New mp3 BaraT !! .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\Lagu - Server .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\sa-533055.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\system\msvbvm60.dll | C:\Windows\M13516\smss.exe | N/A |
| File created | C:\Windows\sa-533055.exe | C:\Windows\M13516\smss.exe | N/A |
| File opened for modification | \??\c:\Windows\InputMethod\SHARED\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\M13516\Ja634608bLay.com | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | \??\c:\Windows\SystemResources\Windows.ShellCommon.SharedResources\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\Titip Folder Jangan DiHapus .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\TutoriaL HAcking .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\TutoriaL HAcking .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\system\msvbvm60.dll | C:\Windows\M13516\EmangEloh.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\Gallery .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | C:\Windows\Ti323741ta.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\[TheMoonlight].txt | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| File opened for modification | \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\Data DosenKu .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\TutoriaL HAcking .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\Titip Folder Jangan DiHapus .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | C:\Windows\sa-533055.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\Lagu - Server .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\sa-533055.exe | C:\Windows\M13516\smss.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\Blink 182 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\M13516\Ja634608bLay.com | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\Ti323741ta.exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| File created | \??\c:\Windows\ServiceProfiles\LocalService\Downloads\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\Windows Vista setup .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\THe Best Ungu .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\M13516 | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | C:\Windows\system\msvbvm60.dll | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| File created | \??\c:\Windows\SoftwareDistribution\Download\RaHasIA .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\Norman virus Control 5.18 .exe | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File created | \??\c:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\Love Song .scr | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| File opened for modification | C:\Windows\M13516\Ja634608bLay.com | C:\Windows\M13516\EmangEloh.exe | N/A |
| File opened for modification | C:\Windows\[TheMoonlight].txt | C:\Windows\M13516\EmangEloh.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\M13516\smss.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\M13516\EmangEloh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile | C:\Windows\M13516\smss.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile | C:\Windows\M13516\EmangEloh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" | C:\Windows\M13516\smss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" | C:\Windows\M13516\EmangEloh.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe | N/A |
| N/A | N/A | C:\Windows\M13516\smss.exe | N/A |
| N/A | N/A | C:\Windows\M13516\EmangEloh.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe
"C:\Users\Admin\AppData\Local\Temp\5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a.exe"
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\service.exe"
C:\Windows\M13516\smss.exe
"C:\Windows\M13516\smss.exe"
C:\Windows\M13516\EmangEloh.exe
"C:\Windows\M13516\EmangEloh.exe"
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O41414Z\winlogon.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
Files
memory/1508-0-0x0000000000400000-0x0000000000435000-memory.dmp
memory/1508-1-0x00000000001C0000-0x00000000001C2000-memory.dmp
C:\Windows\M13516\EmangEloh.exe
| MD5 | 0356b7bb07355265f73cbb010ae45041 |
| SHA1 | 9223d100e366a21ae395c9a7b64b13ddb236c389 |
| SHA256 | 5433c04586cf1ffbacad3b5cb1ed5694f0185035823a582b68adc6020c4c779a |
| SHA512 | 9d5b7177b162135338946ba1bb90d264c646e799c7980f9355973585a73d94010a95b2f8704293d60919639bb142ae7a66205bb1c2927b88b52ff1b4c9a1ea43 |
memory/2464-54-0x00000000001C0000-0x00000000001C2000-memory.dmp
memory/4540-61-0x00000000001E0000-0x00000000001E2000-memory.dmp
C:\Windows\system\msvbvm60.dll
| MD5 | 25f62c02619174b35851b0e0455b3d94 |
| SHA1 | 4e8ee85157f1769f6e3f61c0acbe59072209da71 |
| SHA256 | 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2 |
| SHA512 | f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a |
memory/4540-60-0x0000000000400000-0x0000000000435000-memory.dmp
C:\Windows\[TheMoonlight].txt
| MD5 | 68c7836c8ff19e87ca33a7959a2bdff5 |
| SHA1 | cc5d0205bb71c10bbed22fe47e59b1f6817daab7 |
| SHA256 | 883b19ec550f7ddb1e274a83d58d66c771ab10fefd136bab79483f2eb84e7fec |
| SHA512 | 3656005148788ed7ac8f5b5f8f6f4736c2dc4a94771291170e61666beb81e63be2a1a0f2913233b0e3f12ddfa7f1e89da9cd8323306413395ee78b2ece7fbfe8 |
memory/1508-130-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-112-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2464-219-0x0000000000400000-0x0000000000435000-memory.dmp
memory/4540-220-0x0000000000400000-0x0000000000435000-memory.dmp
memory/216-221-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-222-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2464-223-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-226-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2464-227-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-230-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2464-233-0x0000000000400000-0x0000000000435000-memory.dmp
memory/4540-234-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-236-0x0000000000400000-0x0000000000435000-memory.dmp
memory/216-235-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2464-237-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2464-241-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-244-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-248-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-252-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-253-0x0000000000400000-0x0000000000435000-memory.dmp
memory/216-256-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-257-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2464-258-0x0000000000400000-0x0000000000435000-memory.dmp
memory/216-260-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-261-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-265-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2464-266-0x0000000000400000-0x0000000000435000-memory.dmp
memory/4540-267-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-269-0x0000000000400000-0x0000000000435000-memory.dmp
memory/4540-271-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-273-0x0000000000400000-0x0000000000435000-memory.dmp
memory/2928-277-0x0000000000400000-0x0000000000435000-memory.dmp